CVE-2026-111607

EUVD-2026-103029

16.10.2026, 18:17

Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.1 HIGH	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 15.28%

Common Weakness Enumeration

CWE-639 - Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

https://github.com/jeequan/jeepay/blob/V3.2.9/jeepay-merchant/src/main/java/com/jeequan/jeepay/mch/ctrl/merchant/MchPayInterfaceConfigController.java#L146-L186

https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz

https://www.vulncheck.com/advisories/jeepay-through-3.2.9-idor-via-post-api-mch-payconfigs

https://hackmd.io/@hieuPenguinnn/jeepay-mch-payconfig-write-and-division-receiver-delete-cross-merchant-authz